SAP September 2026 Patch Day: CVSS 10.0 'OVERPASS' Kernel Flaw (CVE-2026-44756) and Three Other Criticals Patched; No Exploitation Reported
Since the previous update (2026-09-09T09:17:54Z), CERT-EU published advisory 2026-011 (2026-09-09), which adds: the SAP Security Notes identifiers 3747649 and 3759472 covering OVERPASS and S4GET; new mechanism detail that S4GET lets unauthenticated attackers register as trusted cluster nodes in the Message Server; that S4GET is reachable through the same public port used by SAP GUI clients,…
SAP's September 2026 Security Patch Day (September 8, 2026) addresses 20 vulnerabilities, headlined by CVE-2026-44756 ('OVERPASS', CVSS 10.0), an unauthenticated remote code execution flaw in the SAP Kernel's Extended Passport (EPP) processing that is…
SAP's September 2026 Security Patch Day (September 8, 2026) addresses 20 vulnerabilities, per BleepingComputer, headlined by CVE-2026-44756, a CVSS 10.0 flaw in the Extended Passport (EPP) processing code of the SAP Kernel, discovered by Onapsis Research Labs and dubbed OVERPASS. Sources characterize the underlying bug slightly differently: SecurityWeek, The Hacker News, Infosecurity Magazine, and CERT-EU describe memory corruption caused by missing boundary validation during deserialization of EPP data, while BleepingComputer describes a buffer overflow in the EPP library of the SAP Kernel; all agree it enables unauthenticated attackers to execute arbitrary OS commands with SAP administrative privileges. The flaw is triggered when a user session opens and is reachable via web requests (through the SAP Internet Communication Manager, per BleepingComputer), SAP GUI, and RFC vectors; The Hacker News notes that no network or authorization control fully mitigates it. Exploitation yields command execution as the SAP OS account — equivalent to owning the system — including database credential and password hash recovery, session reading, and modification of data or binaries (SecurityWeek). Onapsis fingerprinting counted more than 10,000 internet-facing SAP systems. Affected products include S/4HANA, ERP/ECC, NetWeaver, Web Dispatcher, BW/4HANA, Enterprise Portal, and PI/PO (SecurityWeek). Canada's Cyber Centre advisory AV26-894, published September 8, 2026 for SAP Security Patch Day September 2026, additionally lists NetWeaver Message Server, SAP Cloud Application Programming Model, SAP GUI for Java, Integration Suite Cloud Integration, NetWeaver Business Client, and NetWeaver AS for ABAP among affected components, with affected SAP Kernel versions 7.22 through 9.20, CAP versions up to 1.183, 2.7.6, 3.9.6, and 4.0.2, and Integration Suite (TPM) versions; it urges administrators to apply available updates. Three other critical flaws were patched: CVE-2026-58240 ('S4GET', CVSS 9.8 per The Hacker News, Infosecurity Magazine, and CERT-EU), a missing-authentication flaw in the Message Server — described as the NetWeaver Message Server by BleepingComputer, The Hacker News, and CERT-EU and as the S/4HANA Message Server by Infosecurity Magazine — which SecurityWeek says affects all S/4HANA 2025 and earlier releases; per BleepingComputer it enables unauthenticated RCE as <sid>adm across the cluster via the SAP GUI port, and per CERT-EU it lets unauthenticated attackers…
- SAP's September 2026 Security Patch Day addresses 20 vulnerabilities (BleepingComputer); Patch Day is dated September 8, 2026 per Canada's Cyber Centre advisory AV26-894.
- CVE-2026-44756 ('OVERPASS', CVSS 10.0): unauthenticated remote code execution in the SAP Kernel's Extended Passport (EPP) processing, discovered and named by Onapsis Research Labs; most sources describe memory corruption from missing…
- OVERPASS triggers when a user session opens and is reachable via web requests (through the SAP Internet Communication Manager, per BleepingComputer), SAP GUI, and RFC; The Hacker News reports no network or authorization control fully…
- Successful exploitation yields OS command execution as the SAP OS/service account with SAP administrative privileges, plus database credential and password hash recovery, session reading, and modification of data or binaries (SecurityWeek).
- Affected products include S/4HANA, ERP/ECC, NetWeaver, Web Dispatcher, BW/4HANA, Enterprise Portal, and PI/PO (SecurityWeek); advisory AV26-894 lists affected SAP Kernel versions 7.22 through 9.20, CAP versions up to 1.183, 2.7.6, 3.9.6,…
- Onapsis fingerprinting counted more than 10,000 internet-facing SAP systems.
- CVE-2026-58240 ('S4GET', CVSS 9.8): missing authentication check in the Message Server — called the NetWeaver Message Server by BleepingComputer, The Hacker News, and CERT-EU and the S/4HANA Message Server by Infosecurity Magazine —…
- S4GET enables unauthenticated RCE as <sid>adm across the cluster via the SAP GUI port (BleepingComputer); CERT-EU says unauthenticated attackers can register as trusted cluster nodes and that the bug is reachable through the same public…
Coverage
oldest first · one row per article · UTC- · Sep 8, 2026
SecurityWeekFirst report
SAP Patches Critical Extended Passport Processing Vulnerability
SAP patches CVSS 10.0 flaw CVE-2026-44756 (OVERPASS) enabling unauthenticated RCE in S/4HANA and NetWeaver, plus three other criticals; no in-the-wild exploitation reported.
- · Sep 8, 2026
BleepingComputer
SAP warns of maximum severity 'OVERPASS' kernel vulnerability
SAP's September 2026 patches fix maximum-severity kernel flaw CVE-2026-44756 (OVERPASS), letting unauthenticated attackers execute commands on 10,000+ internet-facing SAP systems.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-44756 | Unauthenticated buffer overflow in SAP Kernel Extended Passport (EPP) processing | 10.0 | <1% | ||
| CVE-2026-58231 | Unauthenticated Code Injection RCE in SAP Commerce Cloud | 10.0 | <1% | PoC | |
| CVE-2026-58240 | Unauthenticated Component Registration Flaw in SAP NetWeaver Message Server | 9.8 | <1% | ||
| CVE-2026-66768 | Trust Level Policy Bypass Enables RCE in SAP GUI for Java | 9.0 | <1% | ||
| CVE-2026-76969 | Unauthenticated Credential Theft and Tenant Data Tampering in SAP @sap/cds-mtxs | 9.4 | <1% |